InfoSecBulletin Cybersecurity for mankind
CERT Polska has alerted that bad actors are actively exploiting a security flaw in Zimbra Collaboration Suite to execute code remotely. The bug known as CVE-2026-73570 lets attackers who are not logged in run any commands on affected servers as the zimbra user.
There is a flaw with Zimbra’s SNMP monitoring feature. It has a flaw that allows OS command injection. This affects setups that have the zimbra-snmp package on, SNMP notifications turned on with the snmp_notify setting, and the swatchdog service active.
FortiSandbox, FortiOS, FortiProxy ZTNA flaws unveil, while Fortigate firewall actively exploited
Microsoft Patch Tuesday September 2026 Fixed 973 Flaws Fixed, 2 Zero-Days
A single call: ShinyHunters Gained Access to 6 Million Customers’ Records
The first zero-click worm to spread through WeChat calls across iOS and Android
USA Bimbo Bakeries Confirms Data Stolen in Oracle EBS Zero-Day Attack
ALERT
Roundcube Webmail fixes 12 security flaws, including zero-click XSS and SSRF bypass
New HOOKEDGE Backdoor Deployed by Hackers in European Espionage
Hackers Exploiting MikroTik RouterOS Flaw Gaining Network Access
CrowdStrike launches SafeMind, the first agentic cybersecurity solution for defenders
Claude, DeepSeek, and Qwen AI agents combinedly used to hit gov.t across Asia
Swatchdog is enabled by default, increasing the exposure risk for organizations that have enabled SNMP trap notifications.
Zimbra RCE Vulnerability Exploited
An attacker can send special SMTP requests to take advantage of improper sanitization during SNMP notifications. They do not need to log in first, and this can lead to running any shell command with the rights of the Zimbra account.
This access could let attackers set up web shells, steal email data, change server settings, stay hidden, or use the hacked mail server to attack more.
Zimbra fixed CVE-2026-73570 in version 10.1.20, which came out on July 20, 2026. The security notice from the vendor says that the update solves a command injection issue in the SNMP monitoring part when notifications are turned on.
Organizations using older versions should see this issue as a top priority for fixing because attacks have already been seen in real situations. CERT Polska has also shared advice on how to detect if a system has been compromised.
Administrators need to check /var/log/zimbra.log for strange service-status messages. These messages could show an unknown or bad payload that goes from stopped to running, or from running to stopped.
Such activity may show that a hacker has misused the weak notification system to start or stop processes they control. Security teams need to check files made by the Zimbra user in the last 30 days. The key folders to look at are /opt/zimbra/jetty/webapps/, /opt/zimbra/jetty_base/webapps/, and /tmp/.
Unexpected JSP files, running scripts, zipped files, or recently changed application content in these places may show payload staging or staying power.
Organizations need to quickly find all Zimbra Collaboration Suite servers. They must check if SNMP notifications are on and upgrade any weak systems to version 10.1.20 or a newer fixed version.
Administrators should disable unnecessary SNMP notifications and watch SMTP activity, Zimbra logs, process creation, and file changes involving the zimbra account if emergency patching can’t be done right away.
Any signs of misuse should be seen as a possible problem with the mail server. Admins should keep logs, isolate affected computers if needed, change passwords, check mailbox access, and carry out a complete investigation into the incident.
